External Video For Everybody Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kwiliarty External Video For Everybody allows Stored XSS. This issue affects External Video For Everybody: from n/a through 2.1.1.

Affected:

up to 2.1.1

Fix:

No patched version reported

Disclosed:

Feb 7, 2025

CVE-2025-25097 on NVD →

The External Video For Everybody plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scri...

CVSS:

6.4

Affected:

up to 2.1.1

Fix:

No patched version reported

Disclosed:

Feb 3, 2025

CVE-2025-25097 on NVD →

Update plugin. MustLive discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress External Video For Everybody Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests...

Affected:

up to 2.1

Fixed in:

2.1

Disclosed:

May 15, 2023

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update plugin.

Affected:

up to 2.1

Fixed in:

2.1

Disclosed:

May 15, 2015

The S3 Video, EasySqueezePage, External "Video for Everybody", Videopack, and 1player plugins for WordPress are vulnerable to Reflected Cross-Site Scripting due to inclusion of a vulnerable version of VideoJS in various versions due to insufficient input sanitization and output escaping. This makes it possible for unau...

CVSS:

6.1

Affected:

up to 2.1

Fixed in:

2.1

Disclosed:

May 14, 2015

Affected:

up to 2.1

Fixed in:

2.1